HARD WARE DATA PROTECTION DEVICE
A device is connected between an storage device controller and a storage device, providing data storage device protection in a manner transparent to the computing system and to the user of the computing system independent of operating system. The device protects the user from malicious code by preventing its execution and the unauthorized or unwanted user data modification by making the contents of one of the storage device read only. All the operations of the device are invisible to the computing system and to the user independent of installed operating system. The device can be disabled by a switch or by other means. When this happens the effect is the same as if the device were physically removed of the computing system.
1. Field of the Invention
The present invention relates to data protection device, data modification prevention device, data modification prevention methods and data protection methods independent of operating systems.
2. Description of the Related Art
The present invention addresses the need for data storage device protection where data storage device protection means that there is data storage device that cannot be modified in accidental or non authorized way, and that there is data storage device that cannot be accessed by other than the authorized operator of the computing system. This definition of data storage device protection can be divided in two requirements of protection: Data storage device modification prevention and extraneous code execution prevention. The present invention implements both methods in one data storage protection device without regard to and/or the need for installed operating systems. We start by describing the current state with the first requirement: normally when there is data storage device in a computing system that needs to be protected from accidental or unauthorized modification, said data storage device is marked as “read-only”, and the operation on it is limited by this characteristic. But this “marking” can be un-done or simply ignored by software that does not conform to the operating system conventions or uses a different way of accessing this data storage device on the data storage device used by said computing system. The solution to this would be to make the data storage device “read-only”, in a manner similar to the working of a floppy disk, where a lever on its case allows or denies data storage device modification on its magnetic surface. But this solution does work only for isolated data storage device and it cannot be used when the data storage device also holds data storage device that needs to be modified regularly, for example a directory index maintained by the operating system of the computing system. The second requirement, the extraneous code execution prevention, is currently addressed with a layer of software running as part of the operating system of the computing system, usually called “antivirus” and “firewall” software, depending on its operational and functional characteristics. This layer of software protects the data storage device on a computing system by preventing execution of code that is not specifically part of the code that the user of said computing system is intending to use with its data storage device. The problem with this approach to cover the second requirement is similar to what we specified for the first requirement: the software operation can be bypassed by software that operates not in conformance with operating system rules, or by software that operates using different access rules that the ones specified by the operating system. Well know examples of this are the “rootkits”, pieces of software that operate in a lower level than the operating system, in a way that prevents its detection by the layer of software that implements the extraneous code execution prevention. A normal user is defenseless against this type of intrusion to the computing system.
SUMMARY OF THE INVENTIONIn view of the situation presented above, we say that the object of the present invention is to guarantee that data storage device in a computing system is protected against modifications and to prevent malicious code to execution operations on said system, operating in a manner that is transparent and invisible to the operating system and to the user, it is independent of operating systems. Furthermore, the present invention provides a data storage protection device that is connected between a data storage device and a controlling device that controls the storage device, in such a way that the data present on the data storage device is never modified. To maintain the correct operation of the computing system, the data storage protection device uses an auxiliary storage area that stores all data storage device modifications. The data storage protection device implements an internal table that is used to keep track of the location of the modified data in the storage device. Every time the host system requests one or more sectors from the storage device, the data storage protection device will look-up in its internal table if a corresponding flag for that sector is set or cleared. If the corresponding flag is cleared, then the device will retrieve the sector or sectors from the storage device. If the corresponding flag is set, then the device will retrieve the sector or sectors from the auxiliary storage area. Furthermore, every time the computing system transfers one or more sectors to the storage device, the data storage protection device will redirect the sector or sectors to the auxiliary storage area and it will update its internal table, setting the corresponding flag for the sector number that was written to the auxiliary storage area.
Furthermore, the data storage protection device provides protection against malicious code, forbidding its execution. The data storage protection device prevents code execution when the code is read from the auxiliary storage area and from the BIOS. If the code is read from the secure data storage device it is executed normally. The data storage protection device has a scan unit that scans the data read from the auxiliary storage area to find patterns of bytes that determine that the data can be executed by a given micro processing architecture. The selection of the micro processing architecture and the patterns associated with it are loaded to the data storage protection device in factory. If the scan unit finds the byte pattern, the data storage protection device can either replace the data being read with a predefined value or it can signal the controlling device of the computing system that it has aborted the data transfer. The utility of the execution prevention capability of the data storage protection device of the present invention resides that to execute extraneous code, this code will have to be stored on the auxiliary storage area, as any new data that is being entered to a computing system equipped with the data storage protection device of the present invention.
The internal table of the data storage protection device is non-volatile, for maintaining correct operation in case of power failure of the computing system or in case of the computing system being powered off. The data storage protection device can erase the contents of the internal table, clearing all the flags on it. This is equivalent to return the computing system to its original state, because all the data storage device modifications will not be present anymore for reading by the computer system.
The data storage protection device can be enabled or disabled by means of a mechanical or electric or electronic switch. If the switch is in the “ON” position, the said device is enabled and operates according to the preceding paragraphs. If the switch is in the “OFF” position, the said device is disabled and it does not intercept any read or write operations, thus allowing reading and writing to the storage device. In this mode, the auxiliary storage area is not visible to the host computing system.
The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate numerous embodiments, features, and aspects of the invention and, together with the description, serve to explain the principles of the invention.
The present invention will now be described in detail with reference to the drawings showing various embodiments thereof. In the drawings, elements and parts which are identical throughout the views are designated by identical reference numerals, and duplicate description thereof is omitted.
Now, an embodiment of the present invention will be described in detail with reference to the drawings.
The following description will first be directed to an environment of usage of the data storage protection device according to the embodiment, then to the operations for protecting the data present on the data storage device of the computing system and for preventing execution of malicious code.
Environment of Usage of the Data Storage Protection DeviceThe
The data storage protection device 114 acts like a read switch, represented for clarity purposes in the
Furthermore the data storage protection device 114 provides protection against malicious code by preventing data execution if this data is read from data storage device 103. To perform this function, the custom logic 111 scans the data read from data storage device 103 to find byte patterns that correspond to executable code for a given microprocessor. The custom logic 111 implements an internal table with the byte patterns against which it compares the data read from data storage device 103. If a match is found, the custom logic 111 replaces the contents of the buffer that contained the sector read with arbitrary data storage device, being this arbitrary data or random data or a sequence of bytes with the same value (e.g. 0x0). The custom logic 111 does not operate in this fashion when the data is read from data storage device 102. In this case, the data contained in the read buffer of the custom logic unit 111 is transferred to the computing system unmodified.
For better understanding of the preceding paragraph, a flowchart of the operation of the data storage protection device 114 is depicted on
The operation of the data storage protection device described in the present invention is defined by the custom logic unit 111, being its variations on embodiment only a function of the different interface types that a computing system and its storage units can use. The embodiments depicted in
Furthermore, it could be the case that an embodiment like the one depicted in
The custom logic unit 111 has internally three units, the decision unit 301, the scan unit 302, and the BUS I/F unit 303. Scan unit 302 is connected to the same bus 304 that transfers data back and forth between the decision unit 301 and the BUS I/F 303. This allows the scan unit to search for matching between data read from auxiliary data storage device and its pre-configured byte pattern. The decision unit 301 implements a complex state machine 308. This state machine 308 will cycle through its states according to the DATA STORAGE DEVICE commands received through the DATA STORAGE DEVICE bus 108. Following are the cases of operation of the decision unit 301 according to the DATA STORAGE DEVICE command received through the DATA STORAGE DEVICE bus 108.
Case 1: DATA STORAGE DEVICE PIO IN/DMA IN Commands: As depicted in the
Case 2: DATA STORAGE DEVICE PIO OUT Commands: As depicted in the
Case 3: DATA STORAGE DEVICE Soft RESET: As depicted in
Case 4: DATA STORAGE DEVICE Non Data storage device Commands: As depicted in the
Claims
1-11. (canceled)
12. Apparatus for preventing modification and protecting of data stored in a data storage device present on a computer system in such a manner that presents the illusion/false impression that the data on such existing data storage device can be modified or be copied, the apparatus comprises:
- a local memory device;
- means for connecting existing data storage device;
- means for connecting secondary data storage device;
- means for connecting to the computer system, and appearing to the computer system as if the apparatus was existing data storage device;
- means for storing the address of the data storage device that the computer system wants to write in the data storage device, in a local memory;
- means for transferring data storage device, when requested by the computer system, from existing data storage device or secondary data storage device;
- means for acting as a bridge between computer system and existing data storage device, passing all data through its connection without modification.
13. The apparatus according to claim 12, wherein the connection to the computer system is by means of a data storage device interface.
14. The apparatus according to claim 13, wherein the connection to the existing data storage device and to the secondary data storage device is by means of data storage device interface.
15. The apparatus according to claim 14, wherein the only data storage device connected to it is the previously existing data storage device.
16. The apparatus according to claim 12, comprising means for erasing the local memory contents.
17. The apparatus according to claim 12, further comprising:
- a. Means for preventing modification of data storage device by examining data storage device retrieved from secondary data storage device and replacing retrieved data storage device for an arbitrary pattern, given that a pattern which is not allowed is found.
18. Method for preventing modification of data storage device present on a computer system in such a manner that presents the illusion/false impression that such existing data storage device can be modified, having a local memory, the method comprises the steps of:
- a. Receiving requests from the computing system for retrieving or storing data storage device;
- b. Answering requests from the computing system in a manner indistinguishable from existing data storage device;
- c. Writing received data storage device to secondary data storage device and updating contents of a local memory with the address of the data storage device being written;
- d. Reading data storage device from existing data storage device if the address of the data storage device requested by the computer system is not found on a local memory, or reading data storage device from secondary data storage device otherwise.
19. The method according to claim 18, further comprising the steps of:
- a. Writing received data storage device to second half of existing data storage device and retrieving data storage device from first half if the requested address is not in local memory or from second half otherwise.
20. The method according to claim 19, further comprising the step of:
- a. Clearing local memory contents.
21. The method according to claim 19, further comprising the steps of:
- a. Writing received data to existing data storage device and reading requested data from existing data storage device, in a manner indistinguishable of the operation of same computer system connected directly to the existing data storage device
22. The method according to claim 19, further comprising the steps of:
- a. Storing a table in local memory with a list of patterns are not allowed;
- b. Searching for a byte pattern in data storage device that is retrieved from secondary data storage device;
- c. Found pattern on retrieved data storage device will be changed to an arbitrary pattern before being transferred to the computing system.
Type: Application
Filed: May 29, 2009
Publication Date: Apr 7, 2011
Patent Grant number: 8612708
Inventor: Klaus Drosch (Jarfalla)
Application Number: 12/737,010
International Classification: G06F 12/14 (20060101);